I'm consuming data from Splunk REST API endpoints for other purposes. However, it is throwing this error because I used the "lookup" command in the query. Could anyone assist me in resolving this issue? If the "lookup" command is not used, the query works properly. Error: <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="FATAL">Error in 'lookup' command: Could not construct lookup 'master_sheet.csv, host, as, host, OUTPUT, LOB, Region, Application, Environment'. See search.log for more details.</msg> </messages> </response>   Query: curl -k -u user:pass https://localhost:8089/services/search/jobs --data-urlencode search='search index=foo sourcetype=abc source=*fs.log | rex "(?<Date>.*)\|(?<Mounted>.*)\|(?<Size>.*)\|(?<Used>.*)\|(?<Avail>.*)\|(?<Used_PCT>.*)\|(?<Filesystem>.*)" | eval Used_PCT=replace(Used_PCT,"%","") | search Filesystem IN (/apps, /logs) | stats latest(*) as * by host,Filesystem | where Used_PCT>=80 | sort -Used_PCT | rename Used_PCT as "Use%" | table host,Filesystem,Size,Used,Avail,Use% | lookup master_sheet.csv host as host OUTPUT LOB,Region,Application,Environment | table host,LOB,Region,Application,Environment,Filesystem,Size,Used,Avail,"Use%"' -d id=mysearch_1234567 curl -u user:pass -k https://localhost:8089/services/search/jobs/mysearch_1234567/results --get -d output_mode=csv   ... View more

I have one scheduled report which will provide below table results in email. Requirement is to color the 'Validation Result' like below. But even after seting up these values in 'Advanced edit' option of report, it's not giving colored results. Any suggestion to get this done ? ... View more

I have below 3 different set of events coming from same source. So i have extracted the field using rex command for each type of event. This is working fine when i use each 'rex' command separately. But when i combine all 3 rex commands, it's giving me 0 results. Is there any way to fix this ? host01u,UAT,2300970,app.rmkb.hk-122,,Deployment Success host01u,UAT,2319971,app.bww.label-34,HOLD,Deployment Success host02u,UAT,2319237,app.static-540,No_File My Query: index=foo source=status.list | rex field=_raw "(?<Server>\w+.*)\,(?<Environment>\w+.*)\,(?<Req>\d+.*)\,(?<Package>\w+.*)\,(?<Command>)\,(?<Deploy_Status>\w+.*)" | rex field=_raw "(?<Server>\w+.*)\,(?<Environment>\w+.*)\,(?<Req>\d+.*)\,(?<Package>\w+.*)\,(?<Command>\w+.*)\,(?<Deploy_Status>\w+.*)" | rex field=_raw "(?<Server>\w+.*)\,(?<Environment>\w+.*)\,(?<Req>\d+.*)\,(?<Package>\w+.*)\,(?<Deploy_Status>\w+.*)" | stats latest(*) as * by Server,Environment,Package | table Server,Environment,Req,Package,Deploy_Status | dedup Server,Environment,Req,Package,Deploy_Status | stats count by Deploy_Status ... View more

I have a below table which shows status of package in each host. Normally 2 kinds of packages are there, one with 'bw' word in it and other without 'bw'. In this case, i only care about 'bw' package'. If my 'bw' package status is 'Successful' anywhere, i just want to ignore the other bw rows which has different status(eg. No_File). Is there any way to do this? Highlighted the unwanted rows in yellow color.   Expected Output:   ... View more

I have different kinds of error messages which will be present in WebSphere SystemOut logs. So it would be difficult for me to give error message every time in my query when any new error occurs. So what i want to do is to create one lookup file, which should have all the error messages. So my query should use lookup file to look for error messages and if it's there in logs, it should shows the count of errors based on time by using timechart. My ultimate goal is to give the error messages in lookup file instead of in my search query every time. So that this lookup file can be used anywhere. Please suggest how to create lookup file and search query for this requirement. Sample error messages: SRVE0190E: File not found SRVE0255E: A WebGroup/Virtual Host has not been defined ... View more

I have IBM WebSphere related configuration XML files. Which will get changed whenever any configuration changes happened. I want to compare the my previous XML file content with current XML file based on timestamp. and output should be the difference between both. Is this possible to achieve in Splunk ?   @skakehi_splunk @richgalloway @rnowitzki @woodcock @somesoni2 @niketn  ... View more